My recent commit 5d37acd6b65eb enabled (among other things)
format-arg checking of taint_proper(). This was not a good idea since
taint_proper() adds extra args before it actually calls a printf-style
function. This was masked since on some gcc systems, a NULLOK format arg
disables this check.